Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-me18-9d3t-a7gr
Vulnerability ID VCID-me18-9d3t-a7gr
Aliases CVE-2010-4768
Summary Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.
Status Published
Exploitability 0.5
Weighted Severity 5.4
Risk 2.7
Affected and Fixed Packages Package Details
Weaknesses (1)
Reference id Reference type URL
http://bugs.otrs.org/show_bug.cgi?id=3499
https://api.first.org/data/v1/epss?cve=CVE-2010-4768
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4768
http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:0.5:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:0.5:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:0.5:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:0.5:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:0.5:beta3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:0.5:beta3:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:0.5:beta4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:0.5:beta4:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:0.5:beta5:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:0.5:beta5:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:0.5:beta6:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:0.5:beta6:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:0.5:beta7:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:0.5:beta7:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:0.5:beta8:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:0.5:beta8:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.0.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.0:rc2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.0:rc3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.0:rc3:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.1.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.1.0:rc2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.1.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.1.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.1.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.1.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.1:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.1:rc1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.2.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.2.0:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.2.0:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.2.0:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.2.0:beta3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.2.0:beta3:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.2.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.2.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.2.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.2.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.3.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.3.0:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.3.0:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.3.0:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.3.0:beta3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.3.0:beta3:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.3.0:beta4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.3.0:beta4:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.3.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.3.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:1.3.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:1.3.3:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.0:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.0:beta4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.0:beta5:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.0:beta5:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.0:beta6:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.0:beta6:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.0.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.0:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.0:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.0:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.6:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.7:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.8:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.8:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.1.9:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.1.9:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.0:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.0:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.0:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.0:beta3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.0:beta3:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.0:beta4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.0:beta4:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.3:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.4:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.5:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.6:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.7:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.8:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.8:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.2.9:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.2.9:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.3.0:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.3.0:beta1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.3.0:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.3.0:beta2:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.3.0:beta3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.3.0:beta3:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.3.0:beta4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.3.0:beta4:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.3.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.3.0:rc1:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.3.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.3.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:otrs:otrs:2.3.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:otrs:otrs:2.3.3:*:*:*:*:*:*:*
CVE-2010-4768 https://nvd.nist.gov/vuln/detail/CVE-2010-4768
No exploits are available.
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2010-4768
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete

Exploit Prediction Scoring System (EPSS)
Percentile 0.34114
EPSS Score 0.00141
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:30:47.564394+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0